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Abstract — In this paper, the delay limited secrecy capacity of 
the flat fading channel is investigated under two different as- 
sumptions on the available transmitter channel state information 
(CSI). The first scenario assumes perfect prior knowledge of 
both the main and eavesdropper channel gains. Here, upper and 
lower bounds on the secure delay limited capacity are derived 
and shown to be tight in the high signal-to-noise ratio (SNR) 
regime (for a wide class of channel distributions). In the second 
scenario, only the main channel CSI is assumed to be available at 
the transmitter. Remarkably, under this assumption, we establish 
the achievability of non-zero secure rate (for a wide class of 
channel distributions) under a strict delay constraint. In the two 
cases, our achievability arguments are based on a novel two- 
stage approach that overcomes the secrecy outage phenomenon 
observed in earlier works. 

I. Introduction 

In many applications, there is a delay constraint on the 
data to be transmitted via a wireless link. These applica- 
tions range from the most basic voice communication to 
the more demanding multimedia streaming. However, due 
to its broadcast nature, the wireless channel is vulnerable 
to eavesdropping and other security threats. Therefore, it is 
of critical importance to find techniques to combat these 
security attacks while satisfying the delay limitation imposed 
by the Quality of Service (QoS) constraints. This motivates 
our analysis of the fundamental information theoretic limits 
of secure transmission over fading channels subject to strict 
deadlines. 

Recent works on information theoretic security have been 
largely motivated by Wyner's wire-tap channel model UJ. In 
his seminal work, Wyner proved the achievability of non-zero 
secrecy capacity, assuming that the wiretapper channel is a 
degraded version of the main one, by exploiting the noise to 
create an advantage for the legitimate receiver. The effect of 
fading on the secrecy capacity was further studied in 12] in 
the ergodic setting. The main insight offered by this work is 
that one can opportunistically exploit the fading to achieve a 
non-zero secrecy capacity even if the eavesdropper channel is 
better than the legitimate receiver channel, on the average. 

Delay limited transmission over fading channels has been 
well studied in different network settings and using various 
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traffic models. For example, in f3\, the delay limited capacity 
notion was introduced and the optimal power control policies 
were characterized in several interesting scenarios. In H, the 
strict delay limitation of f3l was relaxed by allowing for 
buffering the packets at the transmitter In this setup, the 
asymptotic behavior of the power-delay trade-off curve was 
characterized yielding valuable insights on the structure of the 
optimal resource allocation strategies [4J. More recently, the 
scheduling problem of data transmission over a finite delay 
horizon assuming perfect CSI was considered in (5]. Our work 
can be viewed as a generalization of |3| where a secrecy 
constraint is imposed on the problem. The extension to the 
bursty traffic scenario is currently under investigation. 

The delay limited transmission of secure data over fading 
channels was considered previously in jS]. In this work, 
the authors attempted to send the secure information using 
binning techniques inspired by the wiretap channel results. 
The drawback of this approach is that it fails to secure the 
information in the particular instants where the eavesdropper 
channel gain is larger than that of the main channel resulting 
in the so-called secrecy outage phenomenon (as defined in 
fSl). Unfortunately, in the delay limited setting, the secrecy 
outage can not made to vanish by increasing the block length 
leading to the conclusion that the delay limited rate achieved 
by this approach is equal to zero for most channel distributions 
of interest 18|. This obstacle is overcome by our two-stage 
approach. Here, the delay sensitive data of the current block 
is secured via Vernam's one time pad approach [6|, which was 
proved to achieve perfect secrecy by Shannon |7|, where the 
legitimate nodes agree on the private key during the previous 
blocks. Since the key packets are not delay sensitive, the 
two nodes can share the key by distributing its bits over 
many fading realizations to capitalize on the ergodic behavior 
of the channel. Through the appropriate rate allocation, the 
key bits can be superimposed on the delay sensitive data 
packets so that they can be used for securing future packets. 
This is referred as key renewal process in the sequel. This 
process requires an initialization phase to share the key needed 
for securing the first data packets. However, the loss in the 
secrecy entailed by the initialization overhead vanishes in 
the asymptotic limit of a large number of data packets. Our 
analytical results establish the asymptotic optimality, with high 
SNR, of this novel approach in the scenario where both the 
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Fig. 1. System Model 



main and eavesdropper channel gains are known a-priori at the 
transmitter (for a wide class of channel distributions). When 
only the main channel CSI is available, this approach is shown 
to achieve a non-zero constant secrecy rate for a wide class of 
quasi-static channels (i.e., the class of invertible channels |31). 

The rest of the paper is organized as follows. Section II 
details the system model and the notations used throughout 
the rest of the paper In Section III, our main results for both 
the full and main CSI cases are obtained. Finally, Section IV 
concludes the paper. 

II. System Model 

The system model is as shown in Figure [T] A source node 
(Alice) communicates with a destination node (Bob) over a 
fading channel in the presence of an eavesdropper (Eve). We 
adopt a block fading model, in which the channel is assumed to 
be constant during a coherence interval and changes randomly 
from an interval to another according to a bounded continuous 
distribution. Also the coherent intervals are assumed to be 
large enough to allow for the use of random coding techniques. 

During any coherence symbol interval i, the signals received 
at the destination and the eavesdropper are given by 



y{i) = gjrL{i)x{i) +Wrn{i), 

z{i) = ge{i)x{i) +We{i), 



(1) 

(2) 



where x{i) is the transmitted symbol, gm(*) and gdi) are the 
main channel and the eavesdropper channel gains respectively, 
Wm{i) and We{i) are the i.i.d. additive white complex gaussian 
noise with unit variance at the legitimate receiver and the 
eavesdropper, respectively. We denote the power gains of the 
fading channels for the main and eavesdropper channels by 
hm{i) = l5m(*)l^ and he{i) = |ffe(«)P' respectively. We 
impose the long term average power constraint P, i.e.. 



qP(h)] < P, 



(3) 



where P(h) is the power allocated for the channel state h = 
{hm, he) and the expectation is over the channel gains. 

The source wishes to send a message W ^ W — 
{1, 2, • • • , M} to the destination. In the following, our delay 
constraint is imposed by breaking our message into packets 
of equal sizes, where each one is encoded independently, 
transmitted in only one coherence block, and decoded by 
the main receiver at the end of this block. Accordingly, the 
total number of channel uses is partitioned into b super-blocks. 
Each super-block is divided into a blocks of ni symbols. 



where n = b a ni and ni denotes the length of coherence 
intervals. We will further represent a fading block with tuple 
(rn, I) such that rn G {1, 2, • • ■ , b} and / e {1, 2, • • • , a}. 
We consider the problem of constructing (Mi,ni) codes 
(M = b a Ml) to transmit the message of the block (to, I), 
W{m,l) e Wi {1, 2, . . . , Ml} to the receiver. Here, 
an (Ajfi,ni) code consists of the following elements: 1) a 
stochastic encoder fmi-) at the source that maps the message 
w{m,l) to a codeword ^"^(to, Z) G X^^, and 2) a decoding 
function Wi at the legitimate receiver, where 

n* — {m — l)ani + Ini denotes the total number received 
signal dimension at the receiver at the end of the block (to, I). 
The average error probability of an (A/i,ni) code is defined 
as 



1 
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where y" represents the total received signals at the legitimate 
receiver at the end of the block (to, I). The equivocation rate 
i?e at the eavesdropper is defined as the entropy rate of the 
transmitted message conditioned on the available CSI and the 
channel outputs at the eavesdropper, i.e.. 



n 



(4) 



where h"^ = {ft,„(l), • • ■ , /?,„i(n)} and /i^ = 
{he{l), ■ ■ ■ , hf,{n)} denote the channel power gains of 
the legitimate receiver and the eavesdropper in n symbol 
intervals, respectively. We consider only the perfect secrecy 
(in the sense of 11]) which requires the equivocation rate i?e 
to be e close to the message rate. The delay limited perfect 
secrecy rate Rg^d is said to be achievable if for any e > 0, 
there exists a sequence of codes (2™^-'^" '', ni) such that for 
any ni > ni{e), we have 
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for any fading block (m, I). 

Finally, we give some notational remarks. We denote the 
delay limited secrecy rate and capacity as R], J and J 
for the full CSI case (both and are known a-priori 
at the transmitter). We respectively use the notation Plf'P 

and C'l.^P for the main CSI case (only g^ is known a-priori 
at the transmitter). We denote [a;]"'" = max{x,0}. And, we 
remark that the expectations are with respect to channel gains 
throughout the sequel. 

III. Main Results 
A. Full CSI Scenario 

First, we give a simple upper bound on the delay limited 
secrecy capacity that will be used later to establish the opti- 
mality of the proposed approach in the high SNR regime. 

Theorem 1: The delay-limited secrecy capacity when both 

( F) 

gm and ge are available at the transmitter, C). ^ , is upper 



bounded by 

Cl?< max min{i?f),i?f)}, 



(5) 



s.l. E[J^(h)]<P 



where Rl and are given as follows. 

R'^f = E[log{l + P{h)Kn)~\ogil + P{h)h, 



R 



minlog(l + P(h)/i„) 

h 



Proof: For a given power allocation scheme P(h), we 



have 



<J < Rf\ 



(6) 



for any achievable delay limited secrecy rate R^f], since 
imposing delay constraint can only degrade the performance. 
We also have, for a given P{h), 



(7) 



since imposing secrecy constraint can not increase the achiev- 
able rate. Then, combining (|6]l and (IT), and maximizing over 
P(h), we obtain 



i? 7 <maxmin{i?f',i?f)}, 



(8) 



for any achievable delay-limited secrecy rate R]. J, which 
proves our result. ■ 
The following result establishes a lower bound on the delay 
limited secrecy capacity using our novel two-stage approach. 
The key idea is to share a private key between Alice and Bob, 
without being constrained by the delay limitation. Then, this 
key is used to secure the delay sensitive data to overcome 
the secrecy outage phenomenon. In the steady state, the key 
renewal process takes place by superimposing the key on the 
delay sensitive traffic. More precisely, as outlined in the proof, 
the delay sensitive traffic (secured by the previous key) serves 
as a randomization signal in the binning scheme used to secure 
the current key. Finally, since is known a-priori at the 
transmitter, one can further increase the delay limited secrecy 
rate by dedicating a portion of the secure rate to the delay 
sensitive traffic (as controlled by the function q{h) in the 
following theorem). 

Theorem 2: The delay-limited secrecy capacity in the full 
CSI scenario is lower bounded as follows. 
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where 



max 

f (h), g(h) 



min{i?l'(h) 

h 



i?o(h)} 



(9) 



i?;'(h)-i?,(h)-i?;(h), 

Rs{\i) [log(l + P(h)/^„0 - log(l + P{h)h,)]+ , 
P;(h) = [log(l + P{h)h„,) ~ log(l + P(h)q(h))] + , 

such that q{h.) is an arbitrary chosen function satisfying 
q{h) > he y he, and Ro is chosen to satisfy the followings. 

E[Po(h)] <E[P;(h)] 
Ro{h) < min {log(l + P(h)/i„), log(l + P{h)he)}ilO) 



Sketch of the Proof: In our scheme, we require Alice to 
transmit a delay constrained data message and a key to Bob. 
The key is used to encrypt data and thus should be secured 
from Eve. A given message w G {1,2,- •■ , 2'-"*-''^=.<' ■'-'} is 
transmitted by sending ba data packets of equal length, each 

represented by D{m, I), where each packet is encoded inde- 

( F) 

pendently and sent with rate R). J during the corresponding 
block of the channel. We further divide a packet to be trans- 
mitted at block (m, I) into two parts Di{m, I) and D2{m, I). 
The first part of data packet is transmitted along with the 
generated key using the one-time pad scheme, whereas the 
second part is transmitted as a secret message. We use a 
separation strategy similar to JO) by sending public and private 
messages simultaneously. But, in contrast to |9|, we here have 
the fading channel as the resource from Alice to Bob and Eve 
and we exploit it to secure the key, and hence, the message. We 
now describe the initial key generation and key renewal. For 
the very first a blocks (the super-block m — 1), we transmit the 
key, K{1), from Alice to Bob securely. Utilizing the ergodicity 
of the channel, we can transmit a key of length aniE[P^,(h)] 
bits [2j. Then, for any super-block m, we will use the key 
K{m — 1) for the one time pad, and also generate a new key 
K{m) for the use in the next super-block. For any given block 
(m, I), we use the niPo(h) remaining bits of the key K{m—1) 
and denote the corresponding bits as K{m,l). These bits 
are used in a one-time pad scheme to construct Do{m, I) — 
Di{m,l) © K{m,l). The encrypted bits are then mapped to 
a message wi(to, e {1,2,- •• ^2"i^°('^^}. The message wi 
along with a possible additional randomization is transmitted 
along with the secret data. Here, the secret data we sent within 
a block is two-fold: W2(m, /) e {1, 2, • • • , 2("i<(h))| ^j^j^jj 
carries the corresponding data D2{m, I) and the key message 
Wkim, e {1, 2, • • • , 2("i^'= These latter messages will 
allow us to generate the key K{m) of the super block m. 

Since ^ oo, a ^ cxd, ni ^ oo, it can be easily shown 
that the rates Po(h), Pg(h), and P"(h) are achievable within 
a given block. Furthermore, the average key rate, E[P(,(h)], 
is achievable within any super-block (see, e.g., [2|). 

We finally argue that the equivocation rate at the eavesdrop- 
per can be made arbitrarily close to the message rate with the 
proposed scheme. Here, we consider equivocation computation 
per block, which will imply the equivocation computation for 
the overall message. For a given block (m, I), the security of 
Wi{m,l) follows from the one-time pad encryption (as the 
key is secured from the eavesdropper |T|) and the security of 
W2{m, I) follows from the wire-tap channel result along with 
the secure rate choice Rg{h) and ^"(h) IJ\. We note that 
during the first super-block wi{l,l) is not encrypted. However, 
this will not affect the overall secrecy of the data as 6 ^ cxd. 
Hence, the equivocation rate can be made close to the message 
rate as 6 ^ oo, a — > cxd, and ni — > oo. 

The achievable rate is then minimized over h to satisfy the 
delay limitation and then maximized over all power control 
policies and functions q{h) (used to allocate rate for W2)- This 
proves the desired result. ■ 



The final step in this section is to prove the asymptotic 
optimality of the proposed security scheme in the high SNR 
regime. The following result establishes this objective by 
showing that the upper and lower bounds of Theorems [T] and |2] 
match in this asymptotic scenario. 

Lemma 3: In an asymptotic regime of high SNR, i.e., P — > 
oo, the delay limited secrecy capacity is given by 



Full CSI at the transmitter 



lim C. 



assuming that E 



E 



1 I 



(11) 



^.^^^ ^ ^ is finite. Moreover, the capacity 
is achieved by the proposed one-time pad encryption scheme 
coupled with the key renewal process. 

Proof: We only need to consider the lower bound since 
the right hand side of (fTTT l is the ergodic secrecy capacity 
in the high SNR regime, which is by definition an upper 
bound on the delay limited secrecy capacity. To this end, we 
set q{h.) = he resulting in i?" (h) = 0. Furthermore, we let 
P(h) = . 1^ , — r, where c is a constant, which is chosen 
according to the average power constraint. The achievable rate 
expression in the high SNR regime is then given by 



lim K 

P^oo 



lim 



mini?o(h), 



(12) 



where Ro{h.) is chosen to satisfy 

E[i?o(h)] < E[l0g(l+P(h)/l™)-l0g(l+P(h)/ie)] + ] 

Ro{h) < log(l + c) 



(13) 

As P — ^ oo, it is easy to see that c oo since 
E ) is finite, implying that the second constraint 

in (fTsl i is loose. Also, it is easy to see that the first constraint 
converges to the right hand side of the lemma. Then, by 

both constraints of 



choosing i?o(h) = Eh^^^h, 
(fTSl l are satisfied and our result is proved. 

The above claim is validated numerically in Fig. 2, where 
Chi-square distribution of degree n = 4 is used for the 
statistics of channel gains of the legitimate receiver and the 
eavesdropper (the gains are assumed to be independent). In 
our simulation, we set q{h.) = (hence i?" = 0) and use 
channel inversion power control policy for the achievable rate. 
Remarkably, even with the suboptimal choice of q{h.) and 
P(h), lower and upper bounds coincides at the high SNR 
regime. 

B. Only Main Channel CSI Scenario 

In this section we assume that only the legitimate receiver 
CSI is available at the transmitter. First, we have the following 
upper bound. 

Theorem 4: The delay-limited secrecy capacity when only 
the legitimate receiver channel state is available at the trans- 
mitter, Cg^'' , is upper bounded by 



{M) 



< 



max : 

.t. E[P(hm)]<P 



iin{pW, 



(14) 
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Fig. 2. Simulation results for the full CSI case 



where ui^^ and P^*^"* are given as follows. 



E [log(l + P{h^)Kn) - l0g(l + P{h^)h,)] + 



R 



(M) 



minlog(l + P{hjn)hr, 



Proof: The proof follows the same argument as that of 
Theorem [T] with the power control policy P{hm)- ■ 

The achievability scheme in this scenario is different from 
the previous scenario in two key aspects: 1) the lack of knowl- 
edge about he forces us to secure the whole delay sensitive 
traffic with the one time pad approach (i.e., setting the rate 
of W2 to zero) to overcome the secrecy outage phenomenon 
and 2) the binning scheme of the key renewal process must 
now operate on the level of the super-block to average-out 
the fluctuations in h^- On the other hand, the delay sensitive 
packet must be decoded after each block which makes it more 
challenging to use it as a randomization for hiding the key. The 
achievable rate reported in the following result is obtained by 
superimposing the binning scheme used in |2|, to achieve the 
ergodic secrecy rate for the key, on the delay limited traffic 
(secured by the key bits sent in the previous super-blocks). 

Theorem 5: The delay-limited secrecy capacity in the only 
main CSI scenario is lower bounded as follows. 



where Rs and P^^^^ are given as follows. 

Rs = E[l0g(l + P{h^)Lm) - Riy - l0g(l + Pihrn)K)] + 

Pf'^ -minlog(H-P(/i,„)/i™) 

Sketch of the Proof: First, fix a power control policy 
P{hjn)- We then divide the channel uses into super-blocks 
and further divide each super-block into blocks as done in the 
proof of Theorem |2] In this scenario, we utilize the achievable 
secure rate within a block only for the key generation. That is. 



max min(p3,pf)V 

!t.\.K[P{hm)\<P 



(15) 



data is transmitted using only the one-time pad encryption in 
contrast to the scheme used in Theorem |2] More specifically, 
the key is decoded at the end of each super-block whereas the 
data packets are still decoded block by block using the key 
sent in the previous super-block. 

A given message w G {1,2,- •■ ,2""=.'' }, is divided into 
ba data packets, each represented by D{m, I), where each 
packet is sent with rate r[^P during the corresponding block 
of the channel. The data packet D{m,l) is transmitted along 
with the generated key using the one-time pad scheme. Initial 
key generation and key renewal is similar to the scheme in 
Theorem 121 For any super-block m, we use the key if (m — 1) 
for the one-time pad, and also generate a new key K{m) for 
the use in the next super-block. 

For any given block {m,l), we use the niR\^2 remaining 
bits from the key K{m — 1) and denote corresponding bits 
as K{m, I), where we set K{0) = 0. These bits are used in 
a one-time pad scheme to construct Do{m, I) = Dim, I) © 
K{m,l). The encrypted bits are then mapped to a message 
w(m, G {1, 2, • • • , 2"^ ^•'i }. At this point, we choose the 
rate of this message to satisfy R^^2 — ^d*^' ^llow a fixed 
rate transmission for every fading state, i.e., to satisfy the delay 
limitation. For the key renewal process, the binning scheme is 
constructed as in the achievable scheme used in f2l . The output 
bits are then grouped in blocks with rates given by log(l 



Main CSI at the transmitter 



P{hm)hr. 



-R 



(Af) 



We then combine those bits with the R 



(M) 



reserved for the encrypted data packet and encode them using 
a capacity achieving codebook (for the main channel). Each 
codeword is decoded at the end of the block releasing the delay 
sensitive packet. In order to decode the key bits, on the other 
hand, one must wait till the end of the binning codeword (i.e., 
a super-block). Following the argument given in ||2l, one can 
see that the following key rate can be achieved with perfect 
secrecy (as 6 ^ oo, a oo, and ni oo). 

R, = E[log(l + P{h^)h,n) - - log(l + P{h^)h,)] + . 

Therefore, if R^^2 chosen as in the theorem, there will be 
enough key bits to encrypt the message of the following block. 
Similar to Theorem IH the un-encrypted messages during the 
very first block becomes negligible as 6 — > cxo, and the 
secrecy requirement can be satisfied. The achievable rate is 
then maximized over all power control policies satisfying the 
average power constraint to obtain the desired result. ■ 
Interestingly, one can easily verify that for a wide class of 
invertible channels (i.e., E i^jt'^ finite), the rate Rf2 
non-zero. Numerical results are provided in Fig. 3, where Chi- 
square distribution of degree n = 4 is used for the channel 
gains. Here, channel inversion power control policy is used for 
both the upper and lower bounds. The non-zero delay limited 
rate is evident in the figure. 

IV. Conclusion 

We have studied the delay-limited secrecy capacity of the 
slow-fading channel under different assumptions on the CSI 
at the transmitter Our achievability arguments are based on 




Fig. 3. Simulation results for the main CSI case. 



a novel two-stage scheme that allows for overcoming the 
secrecy outage phenomenon for a wide class of channels. The 
scheme is based on sharing a delay tolerant private key, using 
random binning, and then using the key to encrypt the the 
delay sensitive packets in a one time pad format. For the full 
CSI case, our scheme is further shown to be asymptotically 
optimal, i.e., high SNR regime, for many relevant channel 
distributions. When only the main channel CSI is available, 
the two-stage scheme achieves a non-zero secure rate, under 
a strict delay constraint, for invertible channels. Finally, one 
can easily identify avenues for future works; three of them are 
immediate, namely 1) obtaining sharp capacity results for finite 
values of SNR, 2) characterizing the optimal power control 
policies, and 3) extending the framework to bursty traffic by 
allowing for buffer delays. 
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